Computer systems often need to collect performance and/or event information. Performance information may include but is not limited to measurements of CPU utilization, response time, memory utilization, I/O bandwidth, etc. A system may monitor a broad variety of events. For example, Web servers will often record http requests received. Database transactions can also be logged. A system may record information for debugging purposes or for profiling the execution of a program.
Information logging incurs overhead. Storing information on disk consumes I/O bandwidth and may require a context switch. Performance may be adversely affected. In addition, significant amounts of disk space may be consumed. Because of the importance of logging information and the high overhead that can result from logging too much information, more efficient methods are needed for collecting performance and event information.
For example, several tools are available for obtaining performance information about computer systems. The Unix operating system (www dot unix dot org) has features such as /proc for obtaining performance information. The Windows operating system from Microsoft (www dot Microsoft dot com) also has a number of features for providing performance information. IBM provides a number of tools for collecting performance information about computer systems through its Tivoli family of software products (www dot Tivoli dot com).
A key problem with these existing solutions is that they can result in too much information being collected. This can result in too much overhead (for both CPU and storage) for collecting performance information.